What PROXY protocol does
When traffic flows player → Arvoris edge → Velocity, the TCP connection your proxy accepts comes from Arvoris — so without help, every player would appear to share edge IPs, breaking IP bans, alt detection and geo plugins. PROXY protocol fixes this: Arvoris prefixes each forwarded connection with a small header carrying the original client address, and Velocity reads it before the Minecraft handshake begins. Unlike some services, Arvoris sends it on **every plan including Free** — real IPs are not a paid upgrade.
The one-line change in velocity.toml
- Stop Velocity (or plan a restart).
- Open `velocity.toml` in the proxy's root directory — via your host's file manager or SFTP.
- In the `[advanced]` section, find `haproxy-protocol` and set it to `true`: `haproxy-protocol = true`.
- Save and start Velocity again.
No plugin, no firewall rules required for the basic setup, and nothing changes on your backend Paper servers — Velocity's own player-info forwarding to them stays exactly as configured. If your network runs BungeeCord instead, the equivalent switch is covered in the BungeeCord guide.
Order of operations matters
Enable this after your traffic actually comes through Arvoris — network created, backend pointing at Velocity's address and port, and `play.yourdomain.com` CNAME'd to your edge endpoint. Flip the flag before DNS moves and every player still connecting via the old record gets rejected. The clean sequence: set up the Arvoris network, switch DNS, wait for propagation, then enable `haproxy-protocol` in one short restart.
Direct connections now fail — and that's a feature
With the flag on, Velocity requires the header. A vanilla client, a bot, or a booter's connection flood hitting your raw backend IP sends ordinary Minecraft packets, fails the PROXY protocol parse, and is dropped instantly. Your leaked IP becomes a dead end: the only working path to your server runs through the filtered edge and antibot gauntlet. For full coverage, firewall Velocity's port to accept only Arvoris traffic so junk packets are dropped at the kernel instead of Velocity's parser.
Testing it
- Connect via `play.yourdomain.com` and check the Velocity console: the join line should show your own IP, not an edge address.
- Run an IP ban against a test account — it should stick to the real address.
- Try connecting to the backend address directly (e.g. `198.51.100.7:25577`): the connection should fail. Success here means your bypass protection works.
Common errors
| "Invalid packet" / garbled bytes in console | Something connected without a PROXY protocol header — old direct connections, scanners, or DNS still pointing at the backend |
| All players see the edge IP still | `haproxy-protocol` not set to `true`, wrong velocity.toml edited, or Velocity not restarted after the change |
| Everyone disconnected after enabling | You flipped the flag before moving DNS to Arvoris — traffic is still arriving directly and gets rejected |
| Backend Paper servers show wrong IPs | Check Velocity's player-info forwarding to backends; PROXY protocol on the public listener is separate from that setting |
Common questions
How do I get real player IPs on Velocity behind a DDoS protection proxy?+
Enable PROXY protocol: open velocity.toml, find the advanced section, set haproxy-protocol = true, and restart Velocity. Arvoris sends the PROXY protocol header on every plan, including Free, so Velocity immediately starts logging and forwarding the true client address instead of the edge IP.
Why does everyone show the same IP on my Velocity server?+
Because traffic arrives via a forwarding proxy, Velocity sees the proxy's address unless you enable PROXY protocol. With haproxy-protocol = true (and your traffic coming through Arvoris), each connection carries the player's real IP in a header that Velocity reads before the Minecraft handshake.
Why can't players connect directly to my server anymore?+
With haproxy-protocol = true, Velocity requires every connection to start with a PROXY protocol header. A vanilla Minecraft client connecting straight to your IP doesn't send one, so the connection is dropped. That's the point: anyone who scrapes your backend IP and tries to bypass the protection gets nothing.
I'm getting 'invalid packet' or garbled errors in the Velocity console — what's wrong?+
Something is connecting without a PROXY protocol header while Velocity expects one — usually a player using the old direct IP, a server-list scanner, or a monitoring ping. If it's all players, your DNS still points at the backend instead of the Arvoris edge. If it's occasional noise from unknown IPs, that's bypass attempts failing; firewall the port to Arvoris-only to silence it.
Do I need PROXY protocol between Velocity and my backend Paper servers?+
No. Velocity passes player info to its backends through its own modern forwarding — leave that as it is. PROXY protocol is only needed on the hop where Arvoris hands connections to Velocity, i.e. Velocity's public listener.
Running Velocity but not protected yet? Create a free network — backend, one DNS record, this one-line change, done in about five minutes.